Deploy and Host Executor on Railway

Executor is the open-source integration layer for AI agents: configure a tool once — an OpenAPI spec, an MCP server, a GraphQL endpoint or a custom JS function — with its auth and per-tool policy, then call it over MCP from any agent you use. This template runs the official single-container self-hosted build with a persistent volume, a pre-created owner account, and generated secrets, so it is usable the moment it finishes deploying.

About Hosting Executor

Executor ships as one container that keeps everything — its libSQL/SQLite database and the generated encryption keys — under /data, so there is no separate database to run. This template mounts a Railway volume there so your catalogue, credentials and policies survive restarts and upgrades, sets the public URL from your Railway domain automatically, and generates the session secret and the master encryption key for you.

It also closes a gap the other self-host templates leave open. Executor's first-run setup makes the first visitor the owner; on a public URL that is a race a stranger can win. This template instead pre-creates the owner from EXECUTOR_BOOTSTRAP_ADMIN_EMAIL and a generated EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD, so the account exists before anyone can claim it. Sign in with that email and the generated password (both visible in the service variables), then change them from the Admin page.

Common Use Cases

One tool catalogue for every agent — register an API once and call it from Claude, Cursor, or any MCP-compatible client without re-wiring credentials each time.
Governed access to internal APIs — put OpenAPI/GraphQL endpoints behind per-tool policies so agents get exactly the operations you allow, with auth held server-side.
A private MCP gateway — expose curated MCP servers to your team from one self-hosted place instead of scattering keys across client configs.

Dependencies for Executor Hosting

Deployment Dependencies

The official upstream image ghcr.io/rhyssullivan/executor-selfhost, pinned to a specific version rather than latest so an auth/crypto service never upgrades itself underneath a running instance.
A single Railway volume mounted at /data for the database and keys.
No external database, cache or message broker — this is a genuine single-service deploy.

Implementation Details

The app listens on port 4788; the domain and healthcheck are wired to it.
BETTER_AUTH_SECRET and EXECUTOR_SECRET_KEY are generated once on deploy. Do not change EXECUTOR_SECRET_KEY afterwards — it is the key that decrypts every stored integration credential, so rotating it makes existing credentials unreadable.
EXECUTOR_WEB_BASE_URL is pre-filled from your Railway domain; if you attach a custom domain, update it to match.

Why Deploy Executor on Railway?

Executor is lightweight — this deploy idles around 150–200 MB of RAM, so it typically costs a few dollars a month. Railway gives it a persistent volume, an HTTPS domain and one-click redeploys, and this template arrives already configured: secrets generated, owner account created, port and domain wired correctly, and every variable pre-filled — there is nothing you are forced to set before it runs.